Hoch
CVE-2026-35643
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 601
Filter zurücksetzen
Hoch
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
Hoch
CVE-2026-35627
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Mittel
CVE-2026-35670
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
Mittel
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Hoch
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Mittel
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
Hoch
CVE-2026-35618
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
Hoch
CVE-2026-32846
OpenClaw is vulnerable to Path Traversal through path validation bypass
Mittel
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
Hoch
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
Hoch
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
Hoch
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Mittel
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
Mittel
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
Hoch
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Hoch
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
Kritisch
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
Hoch
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
Hoch
CVE-2026-32920
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
Hoch
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Mittel
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Mittel
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
Hoch
CVE-2026-32972
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.